If the WordPress login does not work, the cause is not automatically an incorrect password. Cookies, redirects, plugins, themes, the WordPress URL, security features, user accounts, or technical PHP errors can also prevent you from reaching the admin area.
For a quick solution, it is therefore crucial to distinguish the exact error pattern: Is the password rejected? Does the login page not load at all? Are you redirected back to the login form after logging in? Does a blank page, a critical error, or an HTTP 500 error appear?
Briefly explained: First, access the WordPress login page directly and note the exact error message. Then check your login credentials and cookies. If the login still fails, systematically investigate redirects, plugins, themes, and the WordPress configuration. Do not change multiple components at the same time.
Where is the WordPress login located? #
On a standard WordPress installation, you can usually reach the login page via:
or:
If you are not logged in yet, WordPress redirects a call from /wp-admin/ normally forward to the login page.
If WordPress is installed in a subdirectory, it must be part of the URL. For an installation under /wordpress/ could the address be, for example:
1. First, determine the exact error pattern. #
„I can no longer log in to WordPress“ can technically describe very different situations.
Typical failure modes are:
- Username or password is rejected
- Password was forgotten
- Login page is unreachable
/wp-admin/shows an error- After logging in, the login form appears again
- Login ends in a redirect loop
- Browser is reporting issues with cookies
- Login shows an HTTP 403 error
- Login shows an HTTP 500 error
- WordPress reports a critical error
- Login works, but important menu items are missing
- only a specific user cannot log in
These cases should not be treated with the same method.
2. Open login page directly #
If you normally access the admin area via a bookmark or link on your website, try calling the default address directly as a test:
If this URL works, but the login link you used previously does not, the problem might not be with the WordPress login itself.
However, a security plugin may have intentionally changed or protected the default login address. In this case, /wp-login.php deliberately be unreachable as usual.
Check username and password #
If WordPress rejects the login credentials, first check the obvious causes:
- correct username
- correct password
- Capitalization
- accidentally inserted spaces
- correct WordPress installation
- correct domain
Especially when managing multiple WordPress websites, it can happen that login credentials for another installation are used.
Practical Tip: When copying a password from a password manager, make sure that no extra characters or spaces are copied. In the event of repeated failed attempts, you should also consider that a security solution may temporarily block the login.
4. Can I log in with my email address? #
WordPress fundamentally supports logging in with a username or the email address associated with the user account.
If you no longer know your username, trying the registered e-mail address might therefore be worth a try.
However, plugins or individual customizations can change the login behavior.
5. Forgot password #
If you really no longer know the password, you should not begin with technical interventions.
On the WordPress login page, click:
Forgot password?
WordPress can then send a password reset link to the registered email address.
Check your email inbox's spam or junk folder if necessary.
6. Password reset email is not arriving #
If WordPress does not deliver the password email, it does not necessarily mean that your user account does not exist.
WordPress emails may not be delivered or may not be delivered reliably for various reasons.
If you no longer have access to the registered mailbox or the normal reset does not work, an alternative password recovery may be necessary.
For such cases, you should use the existing methods for recovering WordPress administrator access instead of uncontrollably creating new user accounts during a login disruption.
7. Browser Cookies as a Cause #
WordPress uses cookies to manage a successful login or session.
If the required cookies cannot be saved or sent correctly, the login may fail.
A typical symptom is:
- You enter correct access data.
- WordPress is processing the login.
- You will then land back on the login page.
In this case, first test a private or incognito window, or a different browser.
8. Delete cookies for the domain #
If logging in works in a private window but not in a normal browser, stored browser data may be involved.
You can then specifically delete cookies and website data for the domain in question and try logging in again.
A complete deletion of all browser data is normally not necessary for this.
Important: Browser cookies do not explain a PHP fatal error or HTTP 500 error. If WordPress outputs a specific server-side error message, you should investigate that rather than merely clearing the browser cache.
9. Browser blocks cookies #
If cookies are completely blocked in the browser or a browser extension interferes with the login, WordPress may not be able to maintain the session correctly.
Therefore, check for corresponding indications:
- Browser cookie settings
- Privacy or security extensions
- whether the problem also occurs in another browser
10. „Cookies are blocked due to an unexpected output“ #
Under certain conditions, WordPress can display a message during login that indicates cookies and unexpected output.
The actual cause does not necessarily have to lie in the browser.
Unexpected output can occur, for example, through PHP code that sends content before WordPress has been able to set the required HTTP headers.
This can occur, among other things, after changes to PHP files or due to faulty plugins or themes.
If the message started immediately after a code change, that change should be investigated first.
11. Login keeps reloading the same page #
A so-called login loop is a common WordPress problem.
You enter username and password, the page loads – and then you are back at the login form.
Possible causes include:
- Cookie issues
- incorrect WordPress URL
- wrong website URL
- HTTP/HTTPS conflict
- www-non-www conflict
- Plugin
- Cache
- Forwarding rules
Start with browser/cookies and then examine the URL and redirect configuration.
12. Check WordPress address and site address #
WordPress uses under Settings → General including two important URLs:
- WordPress Address (URL)
- Website address (URL)
These values are often referred to as:
WordPress Address (URL)
and
Site Address (URL)
referred to as.
Incorrect values can cause redirection and login issues, among other things.
Do not mix HTTP and HTTPS #
A typical problem arises when WordPress, for example, at:
is operated, but a relevant URL value still points to:
http://deine-domain.ch
shows.
This can cause unwanted redirects or issues with cookies and sessions.
If the website is operated entirely via HTTPS, the relevant WordPress URLs should match the actual configuration.
14. Use www and non-www consistently #
These two addresses are also technically different hosts:
One variant can be redirected to the other. However, the configuration should be consistent.
If WordPress keeps switching back and forth between both variants, the login can be affected.
15. Too many redirects on WordPress login #
If the browser shows a message about too many redirects, multiple systems may be using conflicting rules.
For example, those involved can include:
- WordPress URL Settings
.htaccess- HTTPS redirections
- Security Plugins
- Redirection plugins
- CDN or Reverse Proxy
- Web server configuration
In this case, check which layer executes which redirection.
Attention: Do not add multiple new forwarding rules to „fix“ an already existing redirect loop. First, it must be clarified which rules contradict each other.
16. Set WordPress URL via wp-config.php #
In certain diagnostic or recovery situations, WordPress URLs can be via wp-config.php be strictly prescribed.
The constants for this are:
WP_HOME
and
WP_SITEURL
This method should only be used if you know which URLs are correct for your installation.
If incorrect values are entered there, additional redirection and access issues may arise.
17. Plugin causes the login error #
Plugins can influence the WordPress login in various ways.
Of particular relevance are, for example:
- Security Plugins
- Login protection
- Two-Factor Authentication
- CAPTCHA solutions
- Redirection plugins
- Membership Plugins
- Caching plugins
- Plugins for custom login pages
Basically, however, another plugin can also trigger a PHP error that affects the login or admin area.
18. Error immediately after plugin update #
If the login stops working immediately after a plugin update, the chronological correlation is an important clue.
If the admin area is still partially accessible, the plugin in question can be deactivated there.
If login is no longer possible, manual deactivation for diagnostic purposes may be necessary with appropriate file access.
Plugins are usually located under:
wp-content/plugins/
We cover the systematic approach in detail under Identifying and Resolving Plugin or Theme Conflicts in WordPress.
19. Disable all plugins? #
If no specific plugin is suspected and a plugin conflict is suspected, a controlled diagnosis with disabled plugins can be useful.
However, that should not mean that all plugins are deleted indiscriminately.
The goal is:
- to determine whether plugins are involved at all
- to identify the specific extension
- to subsequently find a permanent solution
For productive websites, you should consider the impact on the shop, forms, security, and other functions.
20. Security plugin blocks login #
Security plugins can limit login attempts or block access based on specific criteria.
For example, after several failed login attempts, an IP address can be temporarily blocked.
An indication of this may be that:
- Logging in from another network works
- only a specific IP is affected
- a corresponding blocking message appears
- the problem started after several failed attempts
Do not permanently disable a security solution just to bypass a block. Check its logs or configuration first.
21. Login URL has been changed #
Some security plugins can replace the standard WordPress login address with a custom URL.
Then can:
/wp-login.php
deliberately no longer functioning as usual.
If you have forgotten the individual login address, you should check the configuration of the plugin in question or the available documentation.
In this case, an unreachable default login URL does not mean that WordPress itself is down.
22. Two-factor authentication is not working #
When two-factor authentication is enabled, the login consists of more than just username and password.
Problems can arise, for example, from:
- lost authenticator device
- missing backup codes
- faulty time synchronization
- Plugin issues
If possible, use the recovery mechanisms provided by the respective 2FA system.
Do not delete database values uncontrollably to bypass two-factor authentication.
23. CAPTCHA prevents login #
If the login page is protected by a CAPTCHA or external bot protection, this service can also affect the login process.
Typical causes can be:
- faulty keys
- changed domain
- blocked external scripts
- Plugin conflict
- faulty configuration
If the error occurs immediately after setting up or changing the CAPTCHA protection, this component should be checked specifically.
Theme can indirectly affect the login #
The standard login page is not rendered like a normal frontend page by the active theme. Nevertheless, theme code or custom code can influence the WordPress process.
Particularly relevant are changes to:
functions.php
or on a child theme.
A PHP error in code loaded there can also affect the admin area or login.
25. HTTP 500 during login #
If /wp-login.php or /wp-admin/ explicitly a:
500 Internal Server Error
delivers, it is no longer primarily a password problem.
Then the server-side cause should be investigated.
Use our guide for this Fixing Error 500 in WordPress: Finding Causes and Solving Systematically.
26. Critical error during login #
If WordPress displays a message about a critical error when accessing the admin area, PHP, plugins, themes, or custom code may be involved, among other things.
In this case, you shouldn't change any more passwords if the login doesn't even technically reach that point.
You can find the appropriate diagnosis under WordPress shows a white screen or a critical error: What to do?.
27. HTTP 403 on Login #
One
403 Forbidden
basically means that the server understands the request, but refuses to authorize it.
Possible causes can vary depending on the environment:
- Security plugin
- Firewall rule
- IP block
- Web server rule
.htaccess- File or directory permissions
Therefore, a 403 should not be addressed by repeatedly resetting the WordPress password.
28. Login page shows 404 #
If /wp-login.php actually returns a 404 error, you should check if:
- WordPress is installed at the expected address
- the file exists
- a security plugin changes the login URL
- Modify access through forwarding or server rules
A common permalink issue is with the physical WordPress file wp-login.php not automatically the most likely explanation.
29. WordPress website itself is not accessible #
If neither the frontend nor the login page is accessible, it may not be a specific login issue.
Then, the domain, DNS, SSL, server, and the general state of the website should be checked first.
Use this for that WordPress website not accessible: systematically check causes.
User account no longer exists #
If WordPress does not recognize a user, the account may have been deleted or modified.
Check – provided another administrator account exists – under:
Users → All Users
whether the account in question still exists.
Do not hastily create a new administrator before it is clarified what happened to the original account.
User role has been changed #
A successful login does not automatically mean that the user has administrator rights.
If you can log in but can no longer see plugins, themes, or settings, for example, your user role may have been changed.
By default, WordPress distinguishes between different roles with different permissions.
In a standard single installation, an administrator has extensive rights. Other roles accordingly see fewer features.
We cover the management of users and roles in our article Manage users in WordPress.
32. Administrator rights suddenly missing #
If a previous administrator suddenly has significantly fewer rights after logging in, the cause should be investigated.
Possible reasons include, for example:
- User role was consciously changed
- Plugin changes permissions
- Migration was incomplete
- Database data has been modified
- Website has been compromised
In the event of unexplained changes to administrator privileges, a security issue should also be considered.
33. Consider multisite #
Additional features regarding roles and network management apply in a WordPress multisite.
A single website administrator is not automatically a network-wide super administrator there.
If features are missing, it should therefore first be clarified whether it is a normal WordPress installation or a Multisite.
34. Change password directly in the database #
If normal password recovery is not possible and no other administrator can help, the administrator password can be reset via the database in certain situations.
This is a recovery method for specific cases and should not be the first step for every login issue.
Particularly in the case of a login loop, an HTTP 500 error, or a cookie problem, a new password would not fix the actual cause.
Important: Before changing user data directly in the database, you should be sure that the issue actually lies with the user account or password. Database changes are not a general repair tool for WordPress login issues.
35. Database Prefix and User Data #
When performing manual database work, you should also not assume that every WordPress installation uses the standard prefix:
wp_
used.
The actual table prefix can be configured individually.
Direct database changes should therefore only be made based on the specific installation.
36. Check wp-config.php after changes #
If login issues occur immediately after a change to:
wp-config.php
should this change occur, it should be reviewed.
For example, individually defined URL, cookie, or other WordPress constants can be relevant.
Do not insert random constants from internet tutorials into wp-config.php one, without understanding their effect.
37. .htaccess and login issues #
On appropriate server environments,
.htaccess
Includes redirects, security rules, and access restrictions.
If login issues occur immediately after modifying this file, it should also be investigated.
Back up the existing file before making any changes.
38. Cache plugin and login #
A properly configured caching system should not treat personalized WordPress administration pages like normal public pages.
However, in the event of a misconfiguration, cache or optimization systems can contribute to unexpected behavior.
If the problem started immediately after changes to cache, optimization, or proxy settings, those settings should be considered.
39. Consider CDN or reverse proxy #
If a CDN or reverse proxy is placed in front of the actual web server, another layer of redirects, HTTPS detection, cookies, or security rules may be involved.
This is particularly relevant if:
- redirect loops occur
- HTTPS is not correctly detected
- only certain IP addresses are blocked
- Login requests are filtered by security rules
In such environments, searching should not be done exclusively within WordPress.
40. Login works on one device only #
If you can log in on one device and not on another, that rather speaks against a completely broken WordPress login.
Check in particular on the affected device:
- Cookies
- Browser extensions
- saved credentials
- VPN or proxy
- local security software
Also test a private browser window.
41. Login only works via a different network #
If the login works via mobile data, for example, but not via the office or home network, an IP-based block or network component may be involved.
Check security and firewall logs in particular before modifying WordPress itself.
42. Login does not work after migration #
Following a website migration, login issues can be caused by the following factors, among others:
- changed domain
- incorrect WordPress URL
- HTTP vs HTTPS differences
- old forwarding rules
- incomplete database transfer
- Plugin configurations
- Cache or proxy
Check in particular whether WordPress is still trying to redirect back to the old domain.
43. Login does not work after domain change #
When changing a domain, the relevant WordPress URLs must match the new domain.
For example, if the login page from:
back to:
jumps, the URL configuration is an obvious starting point.
Stored cookies of the old as well as the new domain should also be taken into account.
44. Login does not work after PHP change #
If the admin area stops working immediately after changing the PHP version, it may be due to an incompatibility with a plugin, theme, or custom code.
PHP and server error logs are particularly informative.
We cover how to change PHP versions in a controlled manner and check compatibility at Change PHP version for WordPress and check compatibility.
45. Login does not work after WordPress update #
Even after a WordPress update, the specific error message should be investigated first.
The update itself does not necessarily have to be faulty. For example, it can expose an existing incompatibility with a plugin or theme.
Therefore, check:
- Error Logs
- Plugins
- Theme
- PHP version
- changes made immediately before the problem
46. Using error logs #
If the login fails due to a technical PHP error, error logs can provide the crucial information.
Check for entries at the time of the failed login attempt.
For example, relevant factors include:
PHP Fatal error
Uncaught Error
Allowed memory size ... exhausted
or file paths within:
wp-content/plugins/
or rather
wp-content/themes/
For the detailed evaluation, follow our article Enable WordPress debugging and use error logs.
47. WordPress Recovery Mode #
If a plugin or theme causes a fatal PHP error, WordPress can use Recovery Mode under suitable conditions and send a corresponding link to the administrator email address.
This can allow logging in to a special recovery session to investigate the problematic component.
When WordPress explicitly reports a critical error, this approach is often more sensible than making immediate changes to the database.
48. Secure login page – but don't hide it at all costs #
A WordPress login page should be adequately protected against automated attacks.
Depending on the website, this may include, for example:
- strong individual passwords
- Two-factor authentication
- limited failed login attempts
- appropriate security mechanisms
- current WordPress, plugin, and theme versions
However, simply changing the login URL does not replace comprehensive security measures for the WordPress installation.
49. Do not rush to create a new administrator #
If your previous account doesn't work, you shouldn't automatically create a new administrator directly in the database.
This does not solve, for example,:
- Cookie issues
- Redirect loops
- PHP error
- Plugin conflicts
- IP blocks
A new account only makes sense if the diagnosis actually reveals a problem with the existing user account.
50. Do not perform multiple repairs at the same time #
A typical problem during troubleshooting is that simultaneously:
- Password changed
- Plugins disabled
.htaccesschanged- Cookies deleted
- Changed PHP
- WordPress URLs changed
become.
If the login works again afterwards, it is hardly traceable which change actually helped.
Therefore, proceed step by step.
51. Systematic approach to WordPress login issues #
- Login page directly via
/wp-login.phpcall up. - Note exact error message.
- Check if the public website is working.
- Check username or email address and password.
- Use the standard password recovery if you have forgotten your password.
- Test in a private browser window or use a different browser.
- Check or delete cookies of the domain.
- Watch out for redirect loops.
- Check HTTP/HTTPS as well as www/non-www.
- Take into account recent changes to plugins, theme, PHP, or configuration.
- Perform targeted conflict diagnosis if a plugin is suspected.
- Analyze error logs in case of HTTP 500 or critical error.
- Check user account and user role if a second administrator access is present.
- Only make direct database changes if they are necessary for the specific root cause.
- Test the login again after every change.
52. What you better shouldn't do in case of login issues #
- do not reinstall WordPress immediately
- do not delete all plugins indiscriminately
- do not immediately create a new administrator in the database
- do not change multiple settings at the same time
wp-config.phpdo not complete with random constants.htaccessdo not overwrite without backup- Do not permanently disable safety features
- Do not attempt to fix HTTP 500 errors by changing passwords
- Do not change user roles without verification
- Do not share passwords with unknown third parties
53. What information helps CURIAWEB support? #
If you can no longer log in to a WordPress website at CURIAWEB, specific details will help with troubleshooting.
Please share if possible:
- affected domain
- exact login URL
- exact error message
- whether the public website works
- Whether "ob" is an abbreviation for something specific or a typo in your source text, it translates to **whether** or **if** in English (from German, for example). If you intended a specific context, please provide the full sentence.
/wp-login.phpis reachable - whether the login redirects back to the login page
- whether an HTTP status like 403 or 500 is displayed
- whether a plugin, theme, or WordPress was updated immediately beforehand
- whether PHP has been changed
- whether domain, HTTPS, or redirects have been changed
- approximate time the problem has existed
Do not send your WordPress password unrequested.
Summary #
If the WordPress login does not work, the exact error symptom should be determined first. An incorrect password, a login loop, a cookie problem, HTTP 403, HTTP 500, and a critical WordPress error require different solutions.
Start with the direct login address /wp-login.php, check login credentials and test the browser or cookies. In case of repeated redirects, you should check WordPress URLs, HTTPS, domain variants, and redirect rules.
If the problem occurs after a plugin, theme, PHP, or WordPress change, the chronological connection is an important clue. In the case of server-side errors, error logs often provide significantly more information than the visible login page.
Direct changes to the database, wp-config.php or .htaccess should only be carried out once the diagnosis provides a concrete reason for it. This way you prevent a single login problem from causing several new errors.
